Our Privacy Policy
This policy describes how and why St Clare Hospice uses your personal information, how we protect your privacy when doing so, and your rights and choices regarding this information. We promise to respect any of your personal information which is under our control and to keep it safe. We will be clear when we collect your information about what we will do with it.
We are a charity focussed on care with relationships with thousands of patients, families, volunteers, supporters and fundraisers, and so we use personal information daily to operate safely, efficiently, and effectively. Our use of personal information allows us to help ensure that everyone receives excellent care at the end of their life and fundraise more efficiently.
This policy was last updated on 30th April 2026.
About St Clare Hospice
St Clare Hospice is a local charity and each year we care for hundreds of people across West Essex and the eastern Hertfordshire border. We provide specialist free, compassionate care and support to adults with life-limiting illnesses, their families and carers.
In this Privacy Policy, “St Clare Hospice”, “we”, or “our” means:
- St Clare West Essex Hospice Care Trust (St Clare Hospice) which is a charitable company registered in England and Wales as a company limited by guarantee under company number 3398955 and with charity registration number 1063631.
- St Clare Hospice Trading Company Limited (which operates the St Clare Hospice Lottery, St Clare Hospice Retail, and any other trading activity we undertake). It is registered in England and Wales under company number 2951374.
The registered office for both companies is: St Clare Hospice, Hastingwood Road, Hastingwood, Essex CM17 9JX.
St Clare Hospice Trading Company is the data controller in respect of all personal data collected in relation to the St Clare Hospice Lottery, Retail and trading businesses and St Clare Hospice is the data controller in respect of all other personal data.
Data controllers are legally responsible for ensuring that personal data they obtain is processed in full compliance with the UK Data Protection Act 2018, the General Data Protection Regulation (UK GDPR) and the Data (Use and Access) Act 2025. This Privacy Policy explains what personal data we collect about you, how we use it, and the steps we take to ensure that it is kept secure. We also explain your rights and how to contact us.
What personal information we collect
Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).
We collect, store and use personal information in our care records, our employment, volunteering and education records, and our supporter and customer records.
We may collect, store and use the following information as part of our care services:
- Personal demographics (including gender, race, ethnicity, sexual orientation, religion)
- Contact details such as names, addresses, telephone numbers and emergency contact(s)
- Medical information including physical health or mental condition, medications, previous treatments and records of care given by other health and social care organisations.
- Any other personal information you provide to us
We may collect, store and use the following information as part of our employment, volunteering and education:
- Personal demographics (including gender, age, race, ethnicity, sexual orientation, religion)
- Contact details such as names, addresses, telephone numbers and emergency contact(s)
- Employment records (including professional membership, references and proof of eligibility to work in the UK and security checks)
- Bank details
- Pension details
- Medical information including physical health or mental condition (occupational health information)
- Information relating to health and safety
- Trade union membership
- Offences (including alleged offences), criminal proceedings, outcomes and sentences
- Employment Tribunal applications, complaints, accidents, and incident details
- Any other personal information you provide to us
We may collect, store and use the following information as part of our supporter and customer records:
- Contact details such as names, addresses, telephone numbers and emails.
- Bank account and credit card details
- Gift/purchase history
- Information as to whether you are a taxpayer to enable us to claim Gift Aid
- Estate information
- Any other personal information you provide to us
Certain types of personal information are in a special category under data protection laws, as they are more sensitive. Examples of this type of sensitive data (known as “special category data”) would be information about health, race, religious beliefs, political views, trade union membership, sex life or sexuality or genetic/biometric information.
We only collect this type of information to the extent that there is a clear reason for us to do so. We will also collect this type of information if you make it public or volunteer it to us. Wherever it is practical for us to do so, we will make clear why we are collecting this type of information and what it will be used for.
How we collect information about you
We collect information in the following ways:
Information you provide to us directly
You may give us your information to engage with any of our services, or to support us as a charity. For example, you may self-refer for our care, sign up for one of our events, make a donation, sign up for Gift Aid as a retail donor, register as a volunteer, or otherwise communicate with us.
If you provide personal data to us relating to any person other than yourself, you must ensure before you do so that they understand how their personal data will be used and that you are authorised to disclose it to us, and to consent to its use on their behalf.
When you use our website, we collect your personal information using cookies and other tracking methods. There are more details on the cookies and tracking methods we use in our Cookie Policy.
In addition, in accordance with common website practice, we will receive information about the type of device you’re using to access our website or apps. Your device manufacturer or operating system provider will have more details about what information your device makes available to us.
Information you provide to us indirectly
Your information may be shared with us by third parties, for example:
- by a third-party healthcare professional who has referred an individual to us for care.
- if a friend or family member signs you up for one of our events.
- independent event organisers, for example fundraising sites like Just Giving, Facebook donations or Enthuse;
We also may receive data about you from subcontractors acting on our behalf who provide us with technical, payment or delivery services, and from business partners, advertising networks and search/analytics providers used on our website.
You should check any privacy policy provided to you where you give your data to a third party.
Information from other sources
We also use information from the following sources:
Social Media
Communication, engagement and actions taken through external social media platforms that we participate on are subject to the terms and conditions as well as the privacy policies held with each social media platform respectively.
Depending on your settings or the privacy policies for social media and messaging services like Facebook, Instagram, or X, you might give us permission to access information from those services, for example when you publicly tag us in an event photo.
You are advised to use social media platforms wisely and communicate / engage upon them with due care and caution about your own privacy and personal details.
Information available publicly
We supplement information on our supporters with information from publicly available sources such as charity websites and annual reviews, corporate websites, public social media accounts, the electoral register and Companies House to create a fuller understanding of someone’s interests and support of St Clare Hospice.
How we use personal information
As an organisation that carries out many different tasks and services, we use personal data for a wide number of purposes.
We will use personal information as part of our service delivery to:
- Deliver safe, effective and personalised care by maintaining accurate and up-to-date health records.
- Share relevant information with other healthcare professionals or services involved in your care.
- Send appointment reminders and other necessary correspondence.
- Monitor and improve the quality of care through audits, service reviews and training.
- Support care funding and meet regulatory reporting requirements.
- Investigate complaints, incidents, and legal obligations.
- Assess eligibility for research or clinical trials and conduct patient satisfaction surveys. (Where possible, we anonymise or pseudonymise personal data and only use or share the minimum necessary information, in line with data protection legislation.)
We may also use personal information across our organisation to:
- provide you with the services, products or information you asked for;
- administer donations, process Gift Aid, and support your fundraising activities;
- maintain a record of your relationship with St Clare Hospice;
- respond to or fulfil any requests, complaints or queries you make to us;
- manage our events;
- to protect the health and safety of you, our staff, volunteers and other members of the public;
- further our charitable objectives;
- send you correspondence and communicate with you, using traditional channels and via social media platforms;
- administer our websites and to troubleshoot, perform data analysis, research, generate statistics and surveys related to our technical systems;
- test our technical systems to make sure they are working as expected;
- display content to you in a way appropriate to the device you are using (for example if you are viewing content on a mobile device or a computer);
- generate reports on our work, services and events;
- safeguard our staff and volunteers;
- conduct due diligence and ethical screening;
- identify potential supporters, donors, researchers or other partners;
- analyse donor behaviour and activity;
- create donor profiles, predict donor behaviour;
- improve the relevance of our communications to supporter groups;
- monitor website use to identify visitor location, guard against disruptive use, monitor website traffic, personalise information which is presented to you and/or to provide you with targeted advertisements;
- process your application for a job or volunteering position;
- conduct training and quality control;
- meet our legal obligations, for instance to perform contracts between you and us, or our obligations to regulators, government and/or law enforcement bodies;
- carry out fraud prevention and money laundering checks;
- undertake credit risk reduction activities; and/or
- establish, defend or enforce legal claims.
How and when you will hear from us
We will contact you when it’s necessary to carry out the things you’ve asked us to do -whether that’s providing care, responding to an enquiry, processing a donation, or keeping you informed about our work. We may also get in touch to share updates, thank you for your support, or let you know about ways to get involved. We aim to communicate respectfully and won’t contact you excessively, but we do want to keep you connected to the impact of your support and the difference it makes.
For example, we may contact you:
- If you are under our care, we may contact you to share important updates about your treatment, appointments, or services we provide.
- If you apply for a job or volunteer role, we will communicate with you about your application, onboarding, and relevant opportunities.
- If you take part in education or training with us, we may send you information about sessions, resources, and future learning opportunities.
- If you register for a St Clare Hospice event or fundraising activity, we’ll send relevant information and reminders.
- If you sign up for a third-party event and choose to fundraise for us, we may contact you with support and guidance.
- To thank you for your involvement, ask for feedback, or share updates relevant to your role or participation.
Our marketing communications may include updates on our work, campaigns, and requests for support. You can choose to opt-out at the time of giving us your information, and every communication will include a way for you to opt-out, if you wish. We may use your previous interactions, location or interests to tailor future communications.
Under the Data Protection and Digital Information Act 2025, charities are permitted to use a soft opt-in approach for electronic marketing communications. This means:
- You do not need to give explicit consent for us to contact you electronically if you have previously shown interest in our charitable work.
- You will always be given a clear opportunity to opt out at the point of data collection and in every communication we send.
We will only use this approach where:
- The communication relates to St Clare Hospice’s charitable purposes.
- You have not opted out of receiving such communications.
You can change your preferences or opt out at any time by:
- Clicking the unsubscribe link in our emails
- Contacting fund@stclarehospice.org.uk
- Calling us on 01279 773700
Even if you opt out of marketing, we may still contact you for administrative reasons – for example, to process a donation, thank you, or coordinate volunteering activities.
We will never sell or rent your personal information to third parties for marketing purposes.
Legal basis for processing
Data protection laws mean that each use we make of personal information must have a “legal basis”. The relevant legal bases are set out in the General Data Protection Regulation (EU Regulation 2016/679) and in current UK data protection legislation.
Specific consent
Consent is where we ask you if we can use your information in a certain way, and you agree to this. Where we use your information for a purpose based on consent, you have the right to withdraw consent for any future use of your information for this purpose at any time.
Legal obligation
We have a basis to use your personal information where we need to do so to comply with one of our legal or regulatory obligations. For example, in some cases we may need to share your information with our various regulators such as the Charity Commission, Fundraising Regulator, Information Commissioner or Gambling Commission, or to use information we collect about you for due diligence or ethical screening purposes.
Performance of a contract / take steps at your request to prepare for entry into a contract
We have a basis to use your personal information where we are entering into a contract with you or performing our obligations under that contract. Examples of this would be if you are buying something from us (for instance an event place) or applying to work/volunteer with us.
Vital interests
We have a basis to use your personal information where it is necessary for us to protect life or health. For instance, if there were to be an emergency impacting individuals at one of our events, or a safeguarding issue which required us to contact people unexpectedly or share their information with emergency services.
Legitimate interests
We have a basis to use your personal information if it is reasonably necessary for us (or others) to do so and in our/their “legitimate interests” (if what the information is used for is fair and does not unduly impact your rights).
We consider our legitimate interests to include all day-to-day activities St Clare Hospice carries out with personal information. Some examples not mentioned under the other bases above where we are relying on legitimate interests are:
- Contacting you about our work and activities, including how you can support us, via post and email if you have previously expressed an interest in our work (for example by donating to St Clare Hospice already);
- analysis of our supporters or potential supporters to predict future donation behaviour, and to improve the relevancy and effectiveness of our communications;
- use of personal information when we are monitoring use of our website or apps for technical purposes;
- use of personal information to administer, review and keep an internal record of the people we work with, including supporters, volunteers and researchers;
- sharing of personal information between relevant teams within St Clare Hospice;
- where you have signed up with us on a charity place for a third-party event (for example a sponsored run not organised by St Clare Hospice), sharing personal information with the third-party event organiser so they can administer the event.
We only rely on legitimate interests where we consider that any potential impact on you (positive and negative), how intrusive it is from a privacy perspective and your rights under data protection laws do not override our (or others’) interests in us using your information in this way. We conduct Legitimate Interest Assessments (LIAs) to ensure our communications are balanced and respectful of your rights. We balance these interests carefully against your rights and freedoms and you can object to this processing at any time.
When we use special category personal data (please see the “What personal information we collect” section above), we require an additional legal basis to do so under data protection laws, so will either do so on the basis of your explicit consent or another route available to us at law for using this type of information (for example if you have made the information manifestly public, we need to process it for employment, social security or social protection law purposes, your vital interests, or, in some cases, if it is in the public interest for us to do so).
Provision of health care
Any personal information we hold about our patients and those under our care is processed for the purposes of ‘provision of health or social care or treatment or the management of health of social care systems and services under chapter 2, section 9 of the Data Protection Act 2018. For further information on this legislation please visit: http://www.legislation.gov.uk/
How we keep your information safe
Our staff are trained to handle your information correctly and protect your confidentiality and privacy.
We aim to maintain high standards, adopt best practice for our record keeping and regularly check on how we are doing. Your information is only collected for our own marketing purposes and is never collected for or sold to other organisations.
Health records are held on paper and electronically and we have a legal duty to keep these confidential, accurate and secure at all times in line with Data Protection legislation.
Personal data in our databases is only accessible by appropriately trained staff and volunteers who need to access your personal data as an essential part of their role. All access is tracked through individual login credentials. We take the security of personal data seriously. We employ security technology, including firewalls, and encryption to safeguard personal data and have procedures in place to ensure that our paper and computer systems and databases are protected against unauthorised disclosure, use, loss and damage. St Clare Hospice maintains PCI-DSS compliance to protect credit card data.
We may use third-party organisations to provide our products and services, or to help us process personal data more effectively in support of our fundraising activities. These may include, for example, technology hosts, printing companies, mailing houses, AI profiling models, and organisations that can claim Gift Aid on our behalf.
Where we use third parties, we only work with providers where we are satisfied that security measures are in place to protect your personal data to a standard at least equivalent to our own. Access to personal data is strictly controlled, and data is processed only within secure systems, in accordance with data processing agreements held with each third-party service provider. Personal data is only used for the purposes set out in this Privacy Notice.
We do not sell personal data but if, for example, we hold an event in conjunction with another organisation, we may share information between us, in which case, we will make that clear to you when you provide the personal data.
We use third party electronic payment providers to administer some transactions. They have their own privacy policies, and we encourage you to read them.
On a very rare occasion, we may need to disclose your details, if required, to the police, regulatory bodies or legal advisors or to comply with a court order or a legal obligation. In these circumstances we will be careful to only provide information that we are required to provide.
Our Commitment to Confidentiality (Caldicott Guardian)
Our organization is committed to protecting your confidential data. We have appointed a Caldicott Guardian, a senior clinician responsible for ensuring that all personally identifiable information is handled safely, ethically, and legally in line with the eight Caldicott Principles. They ensure we only use the minimum necessary data to provide you with care.
How long we keep your information for
We take into account various criteria when determining the appropriate retention period for personal data including:
- the purposes for which we process your personal data and how long we need to keep the data to achieve these purposes;
- how long personal data is likely to remain accurate and up to date;
- for how long the personal data might be relevant to possible future legal claims;
- any applicable legal, accounting, reporting or regulatory requirements which specify how long certain records must be kept.
Sharing your information with other organisations
Sometimes your care may be provided by members of a care team, which might include people from other organisations such as health, social care, education, or other care organisations.
We do not usually ask for your consent to share health information where this is necessary for your direct care, as sharing information in this way is essential to ensure continuity and quality of care. For example, we may share information with health authorities and organisations such as NHS England, NHS trusts, general practitioners (GPs), ambulance services, primary care providers, and other parts of the NHS, as well as organisations contracted to provide services on its behalf.
We may also need to share information from your health records with other non-NHS organisations from which you are also receiving care, such as Social Services, other hospices or private care homes.
We will not disclose any health information to third parties without your explicit consent unless there are specific circumstances that require us to do so, such as when the health or safety of others is at risk or where current legislation permits or requires it.
If you do not want us to share your health information with other organisations in order to provide effective care to you, you have the right to ask us not to. We will discuss with you the implications this may have for your care.
There are occasions where St Clare Hospice is required by law to share information provided to us with other bodies responsible for auditing or administering public funds, in order to prevent and detect fraud. There may also be situations where we are under a duty to share your information, due to a legal requirement. Where there is cause to do this, we will always do our best to notify you of this sharing.
These situations include, but are not limited to:
- disclosure under a court order;
- sharing with the Care Quality Commission for inspection purposes;
- the police for the prevention or detection of crime or where there is an overriding public interest to prevent abuse or serious harm to others and other public bodies (e.g. HMRC for the misuse of public funds in order to prevent and detect fraud).
For any request to transfer your data internationally outside the UK/EU, we will make sure that an adequate level of protection is satisfied before the transfer.
Sometimes, we need to share personal data in order to fulfil our purposes, for example, if we hold an event in conjunction with another organisation, we may share information between us, in which case, we will make that clear to you when you provide the personal data.
To provide our products and services, we may, occasionally, appoint other organisations to carry out some of the processing activities on our behalf. These may include, for example, technology hosts, data analytics providers, printing companies and mailing houses. In these circumstances, we will ensure that your personal data is properly protected and that it is only used in accordance with this Privacy Notice. We do not allow third-party organisations to use our data for their own purposes, and any processing activity operates under strict data sharing and processing agreement in full compliance with UK GDPR.
We use third party electronic payment providers to administer some transactions. They have their own privacy policies, and we encourage you to read them.
We do not sell personal data to other organisations under any circumstances.
Keeping your information up to date
Your personal information is held in both paper and electronic forms for specified periods of time as set out in the NHS Records Management Code of Practice for Health and Social Care and National Archives Requirements. We hold and process your information in accordance with the Data Protection Act 2018, as explained above. In addition, everyone working for St Clare Hospice must comply with the Common Law Duty of Confidentiality and various national and professional standards and requirements.
We have a duty to:
- maintain full and accurate records of the care we provide to you;
- keep records about you confidential and secure;
- provide information in a format that is accessible to you.
Some services at St Clare Hospice provide the option to communicate with patients via email. Please be aware that we cannot guarantee the security of this information whilst in transit, and by requesting this service you are accepting this risk.
You can update or correct your personal data by contacting us and asking us to do it for you (see the section ‘How to contact us’ below). Please include your name, address and/or email address when you contact us as this helps us to ensure that we accept amendments only from the correct person. We encourage you to promptly update your personal data if it changes. If you are providing updates or corrections about another person, we may require you to provide us with proof that you are authorised to provide that information to us
Your rights
Under UK data protection law, you have rights over personal information that we hold about you. We’ve summarised these below:
- Right to request access to the personal data we hold about you, e.g. in health records;
- Right to request the correction of inaccurate or incomplete information recorded in our health records, subject to certain safeguards;
- Right to refuse/withdraw consent to the sharing of your health records: Under the Data Protection Act 2018, we are authorised to process, i.e. share, your health records ‘for the management of healthcare systems and services’. Your consent will only be required if we intend to share your health records beyond these purposes, as explained above (e.g. research). Any consent form you will be asked to sign will give you the option to ‘refuse’ consent and will explain how you can ‘withdraw’ any given consent later. The consent form will also warn you about the possible impact of such refusal/withdrawal;
- Right to request your personal information to be transferred to other providers on certain occasions;
- Right to erasure of your personal information. You may ask us to delete some or all of your personal information and in certain cases. The right only applies to data held at the time the request is received. It does not apply to data that may be created in the future. The right is not absolute and only applies in certain circumstances.
- Right to object to the use of your personal information. If we are processing your personal information based on our legitimate interests or for scientific research or statistics, you have a right to object to our use of your information. If we are processing your personal information for direct marketing purposes, and you wish to object, we will stop processing your information for these purposes as soon as reasonably possible.
If you want to exercise any of the above rights, please contact us on Data Protection Team, St Clare Hospice, Hastingwood Road, CM17 9JX or by email to dpo@stclarehospice.org.uk. We may be required to ask for further information and/or evidence of identity. We will endeavour to respond fully to all requests within one month of receipt of your request, however if we are unable to do so we will contact you with reasons for the delay.
Please note that exceptions apply to a number of these rights, and not all rights will be applicable in all circumstances. For more details we recommend you consult the guidance published by the UK’s Information Commissioner’s Office (ICO).
National Data Opt-Out
Patient information is collected as part of routine health and care provision. This information can also be used for other reasons, including to improve quality and standards of care, research into new treatments and planning services (where a legal basis applies). The majority of the time, anonymised data is used for research and planning so that patients cannot be identified, in which case confidential information is not required.
The National Data Opt-Out was introduced for the health and social care system in 2018. This means that you have a choice about whether you would like your confidential information used for research and planning purposes – if you are happy with the use of your information you do not need to do anything, however if you choose to ‘opt out’, your confidential patient information will still be used to support your care, but will not be used for research purposes.
The national data opt-out also does not apply:
- When required by law, for example a court order;
- When you have given consent, for example for a medical research study;
- When there is an overriding public interest, for example in an epidemic;
- When information that can identify you is removed;
- When there is a specific exclusion, for example for official national statistics like a population census.
To find out more or to register your choice to opt out, please visit www.nhs.uk/your-nhsdata-matters.
Complaints
If you have any concerns or complaints about how we are handling your data, please do not hesitate to get in touch. We appreciate the opportunity this feedback gives us to learn and improve.
You can contact us directly on the details below or read our feedback sharing policy on our website.
The Information Commissioner’s Office (ICO) is the body that regulates St Clare Hospice under Data Protection legislation. https://ico.org.uk/. If you are not satisfied with our response or believe we are processing your personal data not in accordance with the law you can complain to the ICO directly via the contact information on their website.
Changes to this policy
We may change this Privacy Policy from time to time. If we make any significant changes in the way we treat your personal information, we will make this clear on the St Clare Hospice website or by contacting you directly.
Contact us
If you have any questions, comments or suggestions, please let us know via one of the following methods:
- use the contact us form on our website to send us a message;
- Send an email to our data protection officer at dpo@stclarehospice.org.uk
- Phone our supporter care team on 01279 773750
- Write to us at:
Data Protection Officer
St Clare Hospice
Hastingwood Road
Hastingwood
Essex
CM17 9JX